AGENTFORCE-26.2: Agent Action Identity Parameter Without Session Binding
🔴 High · Broken Access Control
Detects agent action inputs that accept caller- or LLM-supplied identity handles (contactId, incident_sys_id, patientId, prechat contact fields) without evidence the implementation binds them to the authenticated session. Prompt injection can then read or mutate another user's records (IDOR).
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-26.2 |
| Severity | High |
| Category | Broken Access Control |
| Compliance | SOC2_CC6, HIPAA |
Remediation
Do not trust LLM-filled identity fields. Resolve the contact/incident from the authenticated session (MessagingSession.ContactId, UserInfo.getUserId, ServiceNow gs.getUserID) and ignore or overwrite the model-supplied id, or verify ownership before every read/write.